02 Maintain: Check for Updated Packages #121
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "02 Maintain: Check for Updated Packages" | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| name: | |
| description: 'Who triggered this build (enter github username to tag yourself)?' | |
| required: true | |
| default: 'monthly run' | |
| skip-restore: | |
| description: 'Force lockfile update?' | |
| required: false | |
| default: false | |
| type: boolean | |
| update-packages: | |
| description: 'Install any package updates?' | |
| required: false | |
| default: true | |
| type: boolean | |
| generate-cache: | |
| description: 'Generate separate package cache?' | |
| required: false | |
| default: false | |
| type: boolean | |
| schedule: | |
| # Run every tuesday | |
| - cron: '0 0 * * 2' | |
| env: | |
| LOCKFILE_CACHE_GEN: ${{ github.event.inputs.generate-cache || 'false' }} | |
| SKIP_RENV_RESTORE: ${{ github.event.inputs.skip-restore || 'false' }} | |
| UPDATE_PACKAGES: ${{ github.event.inputs.update-packages || 'true' }} | |
| jobs: | |
| preflight: | |
| name: "Preflight: Manual or Scheduled Trigger?" | |
| runs-on: ubuntu-latest | |
| outputs: | |
| ok: ${{ steps.check.outputs.ok }} | |
| steps: | |
| - id: check | |
| run: | | |
| if [[ "${{ github.event_name }}" == 'workflow_dispatch' ]]; then | |
| echo "ok=true" >> $GITHUB_OUTPUT | |
| echo "Running on request" | |
| # using single brackets here to avoid 08 being interpreted as octal | |
| # https://github.com/carpentries/sandpaper/issues/250 | |
| elif [ `date +%d` -le 7 ]; then | |
| # If the Tuesday lands in the first week of the month, run it | |
| echo "ok=true" >> $GITHUB_OUTPUT | |
| echo "Running on schedule" | |
| else | |
| echo "ok=false" >> $GITHUB_OUTPUT | |
| echo "Not Running Today" | |
| fi | |
| check-renv: | |
| name: "Check If We Need {renv}" | |
| runs-on: ubuntu-latest | |
| needs: preflight | |
| if: ${{ needs.preflight.outputs.ok == 'true' }} | |
| outputs: | |
| renv-needed: ${{ steps.check-for-renv.outputs.exists }} | |
| steps: | |
| - name: "Checkout Lesson" | |
| uses: actions/checkout@v4 | |
| - id: check-for-renv | |
| run: | | |
| if [[ -d renv ]]; then | |
| echo "exists=true" >> $GITHUB_OUTPUT | |
| fi | |
| update_cache: | |
| name: "Create Package Update Pull Request" | |
| runs-on: ubuntu-22.04 | |
| needs: check-renv | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| actions: write | |
| issues: write | |
| id-token: write # OIDC permission required | |
| if: ${{ needs.check-renv.outputs.renv-needed == 'true' }} | |
| env: | |
| GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} | |
| RENV_PATHS_ROOT: ~/.local/share/renv/ | |
| steps: | |
| - name: "Checkout Lesson" | |
| uses: actions/checkout@v4 | |
| - name: "Set up R" | |
| uses: r-lib/actions/setup-r@v2 | |
| with: | |
| use-public-rspm: true | |
| install-r: false | |
| - name: "Update {renv} deps and determine if a PR is needed" | |
| id: update | |
| uses: carpentries/actions/update-lockfile@main | |
| with: | |
| update: ${{ env.UPDATE_PACKAGES }} | |
| skip-restore: ${{ env.SKIP_RENV_RESTORE }} | |
| generate-cache: ${{ env.LOCKFILE_CACHE_GEN }} | |
| cache-version: ${{ secrets.CACHE_VERSION }} | |
| - name: "Validate Current Org and Workflow" | |
| id: validate-org-workflow | |
| uses: carpentries/actions/validate-org-workflow@main | |
| with: | |
| repo: ${{ github.repository }} | |
| workflow: ${{ github.workflow }} | |
| - name: Configure AWS credentials via OIDC | |
| if: ${{ steps.validate-org-workflow.outputs.is_valid == 'true' }} | |
| uses: aws-actions/configure-aws-credentials@v4.1.0 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }} | |
| aws-region: ${{ secrets.AWS_GH_OIDC_REGION }} | |
| - name: "Set PAT from AWS Secrets Manager" | |
| if: ${{ steps.validate-org-workflow.outputs.is_valid == 'true' }} | |
| id: set-pat | |
| shell: bash | |
| run: | | |
| SECRET=$(aws secretsmanager get-secret-value \ | |
| --secret-id carpentries-bot/github-pat \ | |
| --query SecretString --output text) | |
| PAT=$(echo "$SECRET" | jq -r .[]) | |
| echo "::add-mask::$PAT" | |
| echo "pat=$PAT" >> "$GITHUB_OUTPUT" | |
| - name: "Validate token" | |
| id: validate-token | |
| uses: carpentries/actions/check-valid-credentials@main | |
| with: | |
| token: ${{ steps.set-pat.outputs.pat || secrets.SANDPAPER_WORKFLOW }} | |
| # Create the PR with the following roles in order of preference: | |
| # - Carpentries Bot classic PAT fetched from AWS (will only work in official Carpentries repos) | |
| # - repo-scoped SANDPAPER_WORKFLOW classic PAT (will work in all scenarios) | |
| # - default GITHUB_TOKEN (will work suitably, but PR preflight checks will not occur) | |
| - name: "Create Pull Request" | |
| id: cpr | |
| if: > | |
| steps.update.outputs.n > 0 && | |
| ( | |
| steps.validate-token.outputs.wf == 'true' || | |
| steps.validate-org-workflow.outputs.is_valid == 'false' | |
| ) | |
| uses: carpentries/create-pull-request@main | |
| with: | |
| token: ${{ steps.set-pat.outputs.pat || secrets.SANDPAPER_WORKFLOW || secrets.GITHUB_TOKEN }} | |
| delete-branch: true | |
| branch: "update/packages" | |
| commit-message: "[actions] update ${{ steps.update.outputs.n }} packages" | |
| title: "Update ${{ steps.update.outputs.n }} packages" | |
| body: | | |
| :robot: This is an automated build | |
| This will update ${{ steps.update.outputs.n }} packages in your lesson with the following versions: | |
| ``` | |
| ${{ steps.update.outputs.report }} | |
| ``` | |
| :stopwatch: In a few minutes, a comment will appear that will show you how the output has changed based on these updates. | |
| If you want to inspect these changes locally, you can use the following code to check out a new branch: | |
| ```bash | |
| git fetch origin update/packages | |
| git checkout update/packages | |
| ``` | |
| - Auto-generated by [create-pull-request][1] on ${{ steps.update.outputs.date }} | |
| [1]: https://github.com/carpentries/create-pull-request/tree/main | |
| labels: "type: package cache" | |
| draft: false | |
| - name: "Skip PR creation" | |
| if: ${{ steps.update.outputs.n == 0 }} | |
| run: | | |
| echo "No updates needed, skipping PR creation" | |
| # thanks @Bisaloo! - https://github.com/carpentries/sandpaper/issues/646#issuecomment-2829578435 | |
| - name: "Trigger checks" | |
| if: ${{ steps.cpr.outputs.pull-request-number != '' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh workflow run docker_pr_receive.yaml --field pr_number=${{ steps.cpr.outputs.pull-request-number }} | |
| shell: bash |